[bpmore]

Fixes #15552.

Validator::passesCondition() decides every plain comparison (==, !=, ===, !==, >, >=, < and <=, so is, equals, not, isnt and the shorthand too) by building a source string and passing it to eval(). Under a Content Security Policy that omits 'unsafe-eval', that call throws and conditional fields stop working.

This replaces the eval() with a table of those eight comparisons.

Keeping eval()'s results

prepareLhs() and prepareRhs() JSON-encode string operands, and eval() read them back as string literals. Comparing the prepared operands directly would change results, so:

• String operands are decoded with JSON.parse() before comparing, which gives eval()'s values. Without that, a number field compared with a condition value (age: '13' against 13) is compared with the encoded "13", quotes included, and stops matching.
• Everything else is compared as is. An undefined operand is not valid JSON, so decoding every operand would throw where eval() returned a result.
• An operator outside the eight throws an Error, as eval() threw on a source string it could not parse.

prepareLhs(), prepareRhs(), and the includes, includes_any, contains_any, empty and custom paths are unchanged. Only the three comments that referred to eval() are updated. No compiled files are included.

The narrower change was chosen over returning native values from prepareLhs()/prepareRhs(). That would also remove the encoding, but contains_any matches against the encoded string, so its results for values containing a quote character would change.

Tests

Added to resources/js/tests/FieldConditionsValidator.test.js:

• No eval(): every plain operator, null, true and empty evaluate with globalThis.eval replaced by a function that throws.
• Number against string: a number field against a string condition value, with ==, !=, === and the shorthand.
• Missing field: a field with no value compares as null.
• undefined operand: passesCondition() with an undefined operand returns eval()'s results rather than throwing.

npx vitest run --project unit: 70 of 71 files pass. LivePreview.test.js fails identically on 6.x without this change (localStorage is undefined in that environment).

Against the unchanged eval() implementation, all of the new tests except the no-eval() one pass. That shows the results are unchanged. Two naive rewrites each fail at least one test:

• comparing the encoded operands without decoding: the number-against-string test, and the existing comparison-operator test;
• decoding every operand: the undefined-operand test.

This was prepared with AI assistance and reviewed before submitting.